AI is moving fast
The law is changing. Cyber threats aren’t slowing down. And businesses are still expected to get data protection right.
The ICO’s Data Protection Practitioners’ Conference 2026 brings together data protection professionals, regulators and experts to explore some of the biggest challenges facing organisations today.
The conference includes practical sessions covering everything from agentic AI and automated decision-making to cyber resilience, data protection complaints, international transfers and Subject Access Requests (SARs).
But you don’t need to be a data protection specialist to learn something from the agenda. For UK businesses, there are some clear messages about where data protection is heading and what organisations should be doing now.
AI is no longer something businesses can treat as “an IT issue”
One of the clearest themes running through the conference is artificial intelligence. The agenda includes sessions on agentic AI and AI and automated decision-making, reflecting just how quickly organisations are moving from experimenting with AI to actually building it into their processes and decision-making.
Agentic AI is particularly interesting because AI systems are becoming capable of taking actions rather than simply generating an answer to a question. That creates a much bigger data protection question. If an AI system can access information, make decisions, recommend actions or interact with other systems, businesses need to understand:
- What personal data is it accessing?
- Why does it need that data?
- Where is the information going?
- Who is responsible for the decisions it makes?
- What human oversight is in place?
- What happens when it gets something wrong?
The ICO is also developing guidance around agentic AI, automated decision-making and profiling.
What businesses should do
Don’t wait for AI regulation to become a problem. If your business is already using ChatGPT, Copilot, Gemini or other AI tools, start by mapping how personal data is being used with those tools.
If you’re introducing AI into a business process, involve data protection considerations at the beginning, not after the system has already been deployed.
The Data (Use and Access) Act isn’t something businesses can ignore
The DUAA has been one of the biggest changes to the UK’s data protection landscape.
The ICO confirms that the data protection provisions of the Act are now in force. Importantly, the Act amends rather than replaces the UK GDPR, Data Protection Act 2018 and PECR. The conference reflects this shift with a dedicated session on the new data protection complaints requirements.
This is a good reminder that compliance isn’t simply about having a privacy policy sitting somewhere on your website. Businesses now need to think about how data protection works in practice. For example, organisations must have a process for handling data protection complaints, including providing a clear way for people to complain, acknowledging complaints within 30 days, investigating appropriately and communicating the outcome.
What businesses should do
Don’t just document your compliance. Operate it. Your policies must reflect what actually happens inside your business.
Cyber security and data protection are increasingly connected
Another important theme is cyber resilience. The conference includes a practical session looking at how organisations can become more resilient against evolving cyber threats, including Cyber Essentials, the Cyber Governance Code of Practice and the Cyber Resilience Pledge.
This matters because a cyber incident can very quickly become a data protection incident, such as a stolen laptop, a compromised email account, a phishing attack, ransomware or an employee accidentally sending personal information to the wrong person. The technical security issue and the data protection issue can be two sides of the same incident.
The ICO has also highlighted the importance of organisations taking proactive steps to improve cyber resilience rather than waiting until something goes wrong.
What businesses should do
Ask: “What would happen if we lost access to our data tomorrow?”
Make sure your organisation knows:
- How incidents are reported internally
- Who investigates them
- How you assess whether personal data is involved
- What records need to be kept
- When the ICO may need to be notified
- What you need to tell affected individuals
- What you will do to prevent the same incident happening again
SARs aren’t going away and AI may make them more complicated
Subject Access Requests are another major theme at the conference. The ICO has a dedicated session on handling challenging SARs, covering issues such as reasonable searches, exemptions and difficult requests.
There’s another interesting development in the ICO’s guidance pipeline: guidance on handling subject access requests generated by AI is currently being developed. Technology may change the way people make requests and the way organisations search for information, but the underlying responsibility doesn’t disappear. Businesses still need a sensible, repeatable process for dealing with SARs.
What businesses should do
Make sure you know:
- Who receives SARs.
- Who is responsible for coordinating them.
- Where personal information is stored.
- How searches are carried out.
- How exemptions are considered.
- How the response is reviewed before it is sent.
If your process currently involves someone forwarding an email around the office saying “Does anyone have anything on this person?”, it’s probably time for an upgrade.
Data protection shouldn’t be a barrier to innovation
One of the most positive messages from the conference agenda is that data protection isn’t simply about stopping businesses from doing things. The ICO’s session on health data and research, for example, specifically explores how data protection law can support innovation while protecting people’s privacy. This is an important mindset shift.
Good data protection should help an organisation answer:
“How can we do this safely?”
The DUAA itself is intended, among other things, to support innovation and economic growth while maintaining protections for people’s personal information. For businesses, that means data protection needs to become part of decision-making rather than an obstacle that gets brought in at the end.
Your data flows matter more than another policy document
The conference also includes a session on international transfers which starts with a very familiar problem: you’ve mapped your data flows and identified restricted transfers. What happens next?
That highlights one of the most important foundations of effective data protection: you need to know where your data actually goes.
Many businesses have policies explaining how they should handle personal data. Far fewer have a really clear picture of:
- What personal data they hold
- Where it comes from
- Where it is stored
- Who has access to it
- Which suppliers receive it
- Whether it leaves the UK
- How long it is retained
- Why they are processing it
Without that information, it becomes much harder to manage your risks properly.
The role of data protection is becoming more strategic
Perhaps the biggest lesson from the conference isn’t about one particular piece of legislation or one new technology. It’s about the changing role of data protection.
The conference includes a session called “The Modern DPO: impact, influence and independence”, looking at how data protection professionals can work more effectively with senior leaders, technical teams, cyber security professionals and AI governance teams.
Data protection increasingly sits alongside:
- Cyber security
- AI governance
- Risk management
- Compliance
- Business strategy
- Customer trust
For smaller businesses, you might not have a DPO or dedicated compliance department but the principle still applies. Someone needs to understand how personal data is being used and make sure the business has a practical way of managing the risks.
So, what should your business actually do now?
You don’t need to attend every conference, read every piece of ICO guidance or become a data protection expert but you do need to keep your compliance moving.
Here are five useful actions to take away from the ICO’s 2026 conference agenda:
1. Review your use of AI. Identify where employees are using AI tools and whether personal or confidential information is being entered into them.
2. Check your DUAA changes. Make sure your policies and processes reflect the changes introduced by the Data (Use and Access) Act.
3. Test your breach process. Don’t wait for an incident to discover nobody knows what they’re supposed to do.
4. Review your data flows. Make sure you know what personal data you hold, where it goes and who receives it.
5. Stop treating compliance as a one-off project. Your business, suppliers and technology all change. The law has already changed. Your compliance needs to change too.
Compliance needs to be practical
If there’s one thing we can take from the ICO’s 2026 conference agenda, it’s that data protection is becoming increasingly connected to the way businesses actually operate through AI, cyber security, customer complaints, data transfers, SARs and business innovation. You need to know what you’re doing, why you’re doing it, who is responsible and be able to demonstrate that you’ve thought about it.